I need to know weather I have implemented SCA correctly

Questions
1

I understand my Code is complicated however if you list any questions you may have then I would be happy to answer anything :slight_smile:

Payment Form

<?php
session_start();

error_reporting(32767);


if (isset(_GET['cancel'])) {
    _SESSION[‘privkey’] = ‘’;

header(‘Location: //something(dot)me/dashboard’);

return;

}


// Helps ensure this code has been reached via form submission

if ($_SERVER[‘REQUEST_METHOD’] != ‘GET’) {

error_log(‘Received a non-GET request on Pay Form’);

echo ‘Request not allowed’;

http_response_code(404);

return;

}


// Fail if no products where sent

if (!isset($_GET[‘pay’])) {

echo ‘Invalid product data redirecting to homepage in 5 seconds’;

echo ‘’;

http_response_code(422);

return;

}


nohomescreen = true;
require _SERVER[“DOCUMENT_ROOT”] . ‘…/…/inc/loginverify.php’;


include_once($_SERVER[‘DOCUMENT_ROOT’] . ‘…/…/src/Order/Product/Functions.php’);

include_once(MAINDIR . ‘/src/User/Contact/Functions.php’);


use Square\Environment;

use Defuse\Crypto\Key;

use Defuse\Crypto\Crypto;

use Defuse\Crypto\Exception\CryptoException;

use Kiosk\Product\Func as Product;


$productfunc = new Product;


$dotenv = Dotenv\Dotenv::create(“C:/inetpub/wwwroot/”);

$dotenv->load();

$upper_case_environment = strtoupper(getenv(‘ENVIRONMENT’));


$template = new template(“MAIN”);

$product = new Kiosk\Product\Func;

$user = new \User\Info\Func;


try {

privkey = Key::loadFromAsciiSafeString(_SESSION[‘privkey’]);

cipher = _GET[‘pay’];

} catch (CryptoException $e) {

echo ‘This page has expired’;

http_response_code(422);

return;

}


try {

$datadecode = Crypto::decrypt($cipher, $privkey);

$datesplit = explode("|:|", $datadecode);


$data = json_decode($datesplit[0]);
$type = $datesplit[1];

$user = $user->get_all_user_details();



} catch (Exception $e) {

echo ‘There was an error redirecting to home in 5 seconds’;

echo ‘’;

http_response_code(422);

return;

}


$products = json_encode($data);

?>

<!doctype html>



    
    
    Ashleys Party
    
    ’;

http_response_code(422);

return;

}


privkey = Key::loadFromAsciiSafeString(_SESSION[‘privkey’]);

cipher = _POST[‘pay’];


try {

$datadecode = Crypto::decrypt($cipher, $privkey);

$datesplit = explode("|:|", $datadecode);


$data = $datesplit[0];

$type = $datesplit[1];

} catch (CryptoException $e) {

echo ‘We stopped you from loading this page to prevent you from paying for your item twice’;

http_response_code(422);

return;

}


$payments_api = $client->getPaymentsApi();

$money = new Money();

$money->setAmount($productfunc->get_product_total($data, true, false));

$money->setCurrency(‘GBP’);

$create_payment_request = new CreatePaymentRequest($nonce, uniqid(), $money);


if ($_POST[‘buyerVerification-token’] != ‘’) {

create_payment_request->setVerificationToken(_POST[‘buyerVerification’]);

}


$EMAIL = $USER_DETAILS->GET_DETAILS([‘email’]);

$create_payment_request->setBuyerEmailAddress($EMAIL[‘email’]);


try {

$response = $payments_api->createPayment($create_payment_request);


if ($response->isError()) {

$errors = $response->getErrors();


$errorarray = [];

foreach ($errors as $error) {
  $errorarray += array($error->getDetail());
}

header("Location: /?pay=" . $cipher . '&error=' . urlencode(json_encode($errorarray)));
exit();



}


$payment = json_decode($response->getBody(), true);


userid                 = _SESSION[“userid”];


$id                     = $payment[“payment”][“id”];

$created_at             = $payment[“payment”][“created_at”];

$amount                 = $payment[“payment”][“amount_money”][“amount”];

$currency               = $payment[“payment”][“amount_money”][“currency”];

$status                 = $payment[“payment”][“status”];

$source_type            = $payment[“payment”][“source_type”];

$entry_method           = $payment[“payment”][“card_details”][“entry_method”];

$statement_description  = $payment[“payment”][“card_details”][“statement_description”];

$location_id            = $payment[“payment”][“location_id”];

$order_id               = $payment[“payment”][“order_id”];

$receipt_number         = $payment[“payment”][“receipt_number”];

$receipt_url            = $payment[“payment”][“receipt_url”];


$card_brand             = $payment[“payment”][“card_details”][“card”][“card_brand”];

$last_4                 = $payment[“payment”][“card_details”][“card”][“last_4”];

$exp_month              = $payment[“payment”][“card_details”][“card”][“exp_month”];

$exp_year               = $payment[“payment”][“card_details”][“card”][“exp_year”];

$card_type              = $payment[“payment”][“card_details”][“card”][“card_type”];

$bin                    = $payment[“payment”][“card_details”][“card”][“bin”];


$sqlpayment = “INSERT INTO

payments(square_id, created_at, amount, currency, status, source_type, entry_method, statement_description, location_id, order_id, receipt_number, receipt_url, userid)

VALUES

(’{$id}’,

‘{$created_at}’,

‘{$amount}’,

‘{$currency}’,

‘{$status}’,

‘{$source_type}’,

‘{$entry_method}’,

‘{$statement_description}’,

‘{$location_id}’,

‘{$order_id}’,

‘{$receipt_number}’,

‘{$receipt_url}’,

‘{$userid}’)”;


$sqlcard = “INSERT INTO

payments_card(square_id, card_brand, last_4, exp_month, exp_year, card_type, bin)

VALUES

(’{$id}’,

‘{$card_brand}’,

‘{$last_4}’,

‘{$exp_month}’,

‘{$exp_year}’,

‘{$card_type}’,

‘{$bin}’)”;


$db->query($sqlpayment);

$db->query($sqlcard);


if ($type == ‘normal’) {

foreach (json_decode($data) as $key => $value) {

$amount = $value;

$key = explode(’|’, $key);


  if (isset($key[0])) {
    $name = $key[0];
  } else {
    $name = 'No Name';
  }

  if (isset($key[1])) {
    $description = $key[1];
  } else {
    $description = 'No Description';
  }

  $prodsql = "INSERT INTO 
            `orders`(`square_id`, `product`, `description`, `amount`, `order_id`, `user_id`, `created_at`) 
            VALUES 
            ('{$id}',
             '{$name}',
             '{$description}',
             '{$amount}',
             '{$order_id}',
             '{$userid}',
             '{$created_at}')";
  $db->query($prodsql);
}



} else {

if ($type == ‘menu’ || $type == ‘kiosk’) {

$ordernumber = Orders::count_tally();


  $datajson = $data;
  $prodsql = "INSERT INTO 
            `orders_menu`(`square_id`, `products`, `amount`, `order_id`, `user_id`, `order_num`) 
            VALUES 
            ('{$id}',
             '{$datajson}',
             '{$amount}',
             '{$order_id}',
             '{$userid}',
             '{$ordernumber}')";

  $db->query($prodsql);

  $txt = array(
    'id' => $id,
    'data' => $datajson,
    'amount' => $amount,
    'orderid' => $order_id,
    'userid' => $userid,
    'ordernum' => $ordernumber
  );

  $items = array();
  foreach (json_decode($data) as $key => $value) {
    $items = $items + array($key => $value);
  }

  Orders::print_to_reciept($items, $id, $ordernumber);

  $USER_NAME = $USER_DETAILS->GET_DETAILS(['fname', 'lname']);

  $TOTAL_AMOUNT = $productfunc->get_product_total($data, false, false, true);
  $TOTAL_TAX = $productfunc->get_product_tax($data, false, true);
  $LIST_PRODUCTS = $productfunc->list_products($data, true, true);

  $email_array = array('%NAME%' => $USER_NAME['fname'] . ' ' . $USER_NAME['lname'], '%AMOUNT%' => '&pound;' . $TOTAL_AMOUNT, '%TAXAMOUNT%' => '&pound;' . $TOTAL_TAX, '%LISTITEMS%' => $LIST_PRODUCTS, '%ENDSENTENCE%' => '');

  $SendEmail = new SendEmail($_SESSION['userid']);
  $SendEmail->OPEN_CONNECTION(1);
  $SendEmail->CREATE_EMAIL('Your Order is being prepared', 'Thank you for your order at Ashley\'s Party', $email_array, __MAINDIR__ . '/assets/order.html');
  $SendEmail->SEND_EMAIL();
}
if ($type == 'paycard') {
  foreach (json_decode($data) as $key => $value) {
    $amount = $value;
    $key = explode('|', $key);

    if (isset($key[0])) {
      $name = $key[0];
    } else {
      $name = 'No Name';
    }

    if (isset($key[1])) {
      $description = $key[1];
    } else {
      $description = 'No Description';
    }

    $prodsql = "INSERT INTO 
              `orders_paycard`(`square_id`, `product`, `description`, `amount`, `order_id`, `user_id`, `created_at`) 
              VALUES 
              ('{$id}',
               '{$name}',
               '{$description}',
               '{$amount}',
               '{$order_id}',
               '{$userid}',
               '{$created_at}')";
    $db->query($prodsql);
  }
}
if ($type == 'event') {
  foreach (json_decode($data) as $key => $value) {
    $amount = $value;
    $key = explode('|', $key);

    if (isset($key[0])) {
      $name = $key[0];
    } else {
      $name = 'No Name';
    }

    if (isset($key[1])) {
      $description = $key[1];
    } else {
      $description = 'No Description';
    }

    $prodsql = "INSERT INTO 
              `orders_event`(`square_id`, `product`, `description`, `amount`, `order_id`, `user_id`, `created_at`) 
              VALUES 
              ('{$id}',
               '{$name}',
               '{$description}',
               '{$amount}',
               '{$order_id}',
               '{$userid}',
               '{$created_at}')";
    $db->query($prodsql);
  }
}



}

if (type == 'kiosk') {
    _SESSION[‘privkey’] = ‘’;

header(“Location: //kiosk.something(dot)me/order-complete/{$id}”);

return;

}

if (type == 'menu') {
    _SESSION[‘privkey’] = ‘’;

header(“Location: //something(dot)me/dashboard/order/order-complete/?checkout={$id}&type=menu&ordernum={$ordernumber}”);

}

if (type == 'paycard') {
    _SESSION[‘privkey’] = ‘’;

header(“Location: //something(dot)me/dashboard/order/order-complete/?checkout={$id}&type=paycard”);

}

if (type == 'event') {
    _SESSION[‘privkey’] = ‘’;

header(“Location: //something(dot)me/dashboard/order/order-complete/?checkout={$id}&type=event”);

}

if (type == 'normal') {
    _SESSION[‘privkey’] = ‘’;

header(“Location: //something(dot)me/dashboard/order/order-complete/?checkout={$id}&type=normal”);

}

} catch (ApiException $e) {

echo ‘
SEE A MEMBER OF STAFF
’;

echo ‘Caught exception!
’;

echo ‘Response body:
’;

echo ‘
’;

var_dump($e->getResponseBody());

echo ‘
’;

echo ‘
Context:
’;

echo ‘
’;

var_dump($e->getContext());

echo ‘
’;

exit();

}